CVE-2024-0955: 
Tenable Nessus vulnerability analysis and mitigation

A stored XSS (Cross-Site Scripting) vulnerability was discovered in Nessus application versions 10.6.4 and earlier, tracked as CVE-2024-0955. The vulnerability was discovered by Chris Haller (m4lwhere) and reported to Tenable on January 15, 2024. The issue was confirmed as valid on January 22, 2024, and a fix was released on February 6, 2024 with Nessus version 10.7.0 (Tenable Advisory).

The vulnerability allows an authenticated remote attacker with administrator privileges to alter Nessus proxy settings, which could lead to the execution of remote arbitrary scripts. The vulnerability has been assigned a CVSSv3.1 base score of 4.8 (Medium) with the vector string AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, high privileges required, and user interaction needed (Tenable Advisory).

If exploited, this vulnerability could allow an attacker with administrator privileges to execute arbitrary scripts through manipulated proxy settings. The impact is considered Medium severity due to the high privilege requirement and the limited scope of potential damage, affecting only confidentiality and integrity with low impact (Tenable Advisory).

Tenable has released Nessus version 10.7.0 to address this vulnerability. Users are advised to upgrade to this version to mitigate the risk. The installation files can be obtained from the Tenable Downloads Portal (Tenable Advisory).